Fix CORS in devhub test receipts (bug 1104371)

This also fixes the CORS decorator which was
previously broken for OPTIONS requests.

@mstriemer r?
I think `GET` calls happen without an `OPTIONS`. So it makes sense to test the `GET` case also.